* [PATCH V2] drm: hold gem reference until object is no longer accessed
@ 2020-07-20 22:30 ` Steve Cohen
0 siblings, 0 replies; 10+ messages in thread
From: Steve Cohen @ 2020-07-20 22:30 UTC (permalink / raw)
To: dri-devel, freedreno, linux-arm-msm
Cc: Steve Cohen, sam, daniel, seanpaul, pdhaval, jsanka, adelva
A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.
Signed-off-by: Steve Cohen <cohens@codeaurora.org>
---
drivers/gpu/drm/drm_gem.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 7bf628e..ee2058a 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
* @file_priv: drm file-private structure
*
* Open an object using the global name, returning a handle and the size.
- *
- * This handle (of course) holds a reference to the object, so the object
- * will not go away until the handle is deleted.
*/
int
drm_gem_open_ioctl(struct drm_device *dev, void *data,
@@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
- drm_gem_object_put_unlocked(obj);
if (ret)
- return ret;
+ goto err;
args->handle = handle;
args->size = obj->size;
- return 0;
+err:
+ drm_gem_object_put_unlocked(obj);
+ return ret;
}
/**
--
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH V2] drm: hold gem reference until object is no longer accessed
@ 2020-07-20 22:30 ` Steve Cohen
0 siblings, 0 replies; 10+ messages in thread
From: Steve Cohen @ 2020-07-20 22:30 UTC (permalink / raw)
To: dri-devel, freedreno, linux-arm-msm
Cc: adelva, Steve Cohen, pdhaval, seanpaul, sam
A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.
Signed-off-by: Steve Cohen <cohens@codeaurora.org>
---
drivers/gpu/drm/drm_gem.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 7bf628e..ee2058a 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
* @file_priv: drm file-private structure
*
* Open an object using the global name, returning a handle and the size.
- *
- * This handle (of course) holds a reference to the object, so the object
- * will not go away until the handle is deleted.
*/
int
drm_gem_open_ioctl(struct drm_device *dev, void *data,
@@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
- drm_gem_object_put_unlocked(obj);
if (ret)
- return ret;
+ goto err;
args->handle = handle;
args->size = obj->size;
- return 0;
+err:
+ drm_gem_object_put_unlocked(obj);
+ return ret;
}
/**
--
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH V2] drm: hold gem reference until object is no longer accessed
2020-07-20 22:30 ` Steve Cohen
@ 2020-07-27 19:55 ` Greg KH
-1 siblings, 0 replies; 10+ messages in thread
From: Greg KH @ 2020-07-27 19:55 UTC (permalink / raw)
To: Steve Cohen
Cc: dri-devel, freedreno, linux-arm-msm, sam, daniel, seanpaul,
pdhaval, jsanka, adelva
On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> A use-after-free in drm_gem_open_ioctl can happen if the
> GEM object handle is closed between the idr lookup and
> retrieving the size from said object since a local reference
> is not being held at that point. Hold the local reference
> while the object can still be accessed to fix this and
> plug the potential security hole.
>
> Signed-off-by: Steve Cohen <cohens@codeaurora.org>
> ---
> drivers/gpu/drm/drm_gem.c | 10 ++++------
> 1 file changed, 4 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index 7bf628e..ee2058a 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
> * @file_priv: drm file-private structure
> *
> * Open an object using the global name, returning a handle and the size.
> - *
> - * This handle (of course) holds a reference to the object, so the object
> - * will not go away until the handle is deleted.
> */
> int
> drm_gem_open_ioctl(struct drm_device *dev, void *data,
> @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
>
> /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
> ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> - drm_gem_object_put_unlocked(obj);
> if (ret)
> - return ret;
> + goto err;
>
> args->handle = handle;
> args->size = obj->size;
>
> - return 0;
> +err:
> + drm_gem_object_put_unlocked(obj);
> + return ret;
> }
>
> /**
As this seems to fix an important issue, any reason it wasn't cc: stable
on it so that it gets backported properly?
How about a "Fixes:" tag so that we know what commit id it fixes so we
know how far back to backport things?
And a hint to the maintainers that "this is an issue that needs to get
into 5.8-final, it shouldn't wait around longer please" would have also
been nice to see :)
And what chagned from v1, aren't you supposed to list that somewhere in
the changelog or below the --- line (never remember what DRM drivers
want here...)
Care to send a v3?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH V2] drm: hold gem reference until object is no longer accessed
@ 2020-07-27 19:55 ` Greg KH
0 siblings, 0 replies; 10+ messages in thread
From: Greg KH @ 2020-07-27 19:55 UTC (permalink / raw)
To: Steve Cohen
Cc: adelva, freedreno, linux-arm-msm, dri-devel, pdhaval, seanpaul, sam
On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> A use-after-free in drm_gem_open_ioctl can happen if the
> GEM object handle is closed between the idr lookup and
> retrieving the size from said object since a local reference
> is not being held at that point. Hold the local reference
> while the object can still be accessed to fix this and
> plug the potential security hole.
>
> Signed-off-by: Steve Cohen <cohens@codeaurora.org>
> ---
> drivers/gpu/drm/drm_gem.c | 10 ++++------
> 1 file changed, 4 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index 7bf628e..ee2058a 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
> * @file_priv: drm file-private structure
> *
> * Open an object using the global name, returning a handle and the size.
> - *
> - * This handle (of course) holds a reference to the object, so the object
> - * will not go away until the handle is deleted.
> */
> int
> drm_gem_open_ioctl(struct drm_device *dev, void *data,
> @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
>
> /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
> ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> - drm_gem_object_put_unlocked(obj);
> if (ret)
> - return ret;
> + goto err;
>
> args->handle = handle;
> args->size = obj->size;
>
> - return 0;
> +err:
> + drm_gem_object_put_unlocked(obj);
> + return ret;
> }
>
> /**
As this seems to fix an important issue, any reason it wasn't cc: stable
on it so that it gets backported properly?
How about a "Fixes:" tag so that we know what commit id it fixes so we
know how far back to backport things?
And a hint to the maintainers that "this is an issue that needs to get
into 5.8-final, it shouldn't wait around longer please" would have also
been nice to see :)
And what chagned from v1, aren't you supposed to list that somewhere in
the changelog or below the --- line (never remember what DRM drivers
want here...)
Care to send a v3?
thanks,
greg k-h
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH V2] drm: hold gem reference until object is no longer accessed
2020-07-27 19:55 ` Greg KH
@ 2020-07-27 20:11 ` daniel
-1 siblings, 0 replies; 10+ messages in thread
From: daniel @ 2020-07-27 20:11 UTC (permalink / raw)
Cc: Steve Cohen, dri-devel, freedreno, linux-arm-msm, sam, daniel,
seanpaul, pdhaval, jsanka, adelva
On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
> On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> > A use-after-free in drm_gem_open_ioctl can happen if the
> > GEM object handle is closed between the idr lookup and
> > retrieving the size from said object since a local reference
> > is not being held at that point. Hold the local reference
> > while the object can still be accessed to fix this and
> > plug the potential security hole.
> >
> > Signed-off-by: Steve Cohen <cohens@codeaurora.org>
> > ---
> > drivers/gpu/drm/drm_gem.c | 10 ++++------
> > 1 file changed, 4 insertions(+), 6 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> > index 7bf628e..ee2058a 100644
> > --- a/drivers/gpu/drm/drm_gem.c
> > +++ b/drivers/gpu/drm/drm_gem.c
> > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
> > * @file_priv: drm file-private structure
> > *
> > * Open an object using the global name, returning a handle and the size.
> > - *
> > - * This handle (of course) holds a reference to the object, so the object
> > - * will not go away until the handle is deleted.
> > */
> > int
> > drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
> >
> > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
> > ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> > - drm_gem_object_put_unlocked(obj);
> > if (ret)
> > - return ret;
> > + goto err;
> >
> > args->handle = handle;
> > args->size = obj->size;
> >
> > - return 0;
> > +err:
> > + drm_gem_object_put_unlocked(obj);
> > + return ret;
> > }
> >
> > /**
>
> As this seems to fix an important issue, any reason it wasn't cc: stable
> on it so that it gets backported properly?
>
> How about a "Fixes:" tag so that we know what commit id it fixes so we
> know how far back to backport things?
>
> And a hint to the maintainers that "this is an issue that needs to get
> into 5.8-final, it shouldn't wait around longer please" would have also
> been nice to see :)
>
> And what chagned from v1, aren't you supposed to list that somewhere in
> the changelog or below the --- line (never remember what DRM drivers
> want here...)
>
> Care to send a v3?
Don't worry, I'm pushing this to drm-misc-fixes now, should still make it
to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the bug
is rather old. Also, worst case you leak 32bit of some kernel memory that
got reused already (but yeah I know that's often enough to get the foot in
somewhere nasty and crack the door open).
I think it fell through cracks because Sam said he'll apply, guess that
didn't happen.
Also yes a changelog, somewhere, for next time around.
-Daniel
>
> thanks,
>
> greg k-h
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH V2] drm: hold gem reference until object is no longer accessed
@ 2020-07-27 20:11 ` daniel
0 siblings, 0 replies; 10+ messages in thread
From: daniel @ 2020-07-27 20:11 UTC (permalink / raw)
Cc: adelva, Steve Cohen, freedreno, dri-devel, pdhaval, seanpaul,
linux-arm-msm, sam
On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
> On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> > A use-after-free in drm_gem_open_ioctl can happen if the
> > GEM object handle is closed between the idr lookup and
> > retrieving the size from said object since a local reference
> > is not being held at that point. Hold the local reference
> > while the object can still be accessed to fix this and
> > plug the potential security hole.
> >
> > Signed-off-by: Steve Cohen <cohens@codeaurora.org>
> > ---
> > drivers/gpu/drm/drm_gem.c | 10 ++++------
> > 1 file changed, 4 insertions(+), 6 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> > index 7bf628e..ee2058a 100644
> > --- a/drivers/gpu/drm/drm_gem.c
> > +++ b/drivers/gpu/drm/drm_gem.c
> > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
> > * @file_priv: drm file-private structure
> > *
> > * Open an object using the global name, returning a handle and the size.
> > - *
> > - * This handle (of course) holds a reference to the object, so the object
> > - * will not go away until the handle is deleted.
> > */
> > int
> > drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
> >
> > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
> > ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> > - drm_gem_object_put_unlocked(obj);
> > if (ret)
> > - return ret;
> > + goto err;
> >
> > args->handle = handle;
> > args->size = obj->size;
> >
> > - return 0;
> > +err:
> > + drm_gem_object_put_unlocked(obj);
> > + return ret;
> > }
> >
> > /**
>
> As this seems to fix an important issue, any reason it wasn't cc: stable
> on it so that it gets backported properly?
>
> How about a "Fixes:" tag so that we know what commit id it fixes so we
> know how far back to backport things?
>
> And a hint to the maintainers that "this is an issue that needs to get
> into 5.8-final, it shouldn't wait around longer please" would have also
> been nice to see :)
>
> And what chagned from v1, aren't you supposed to list that somewhere in
> the changelog or below the --- line (never remember what DRM drivers
> want here...)
>
> Care to send a v3?
Don't worry, I'm pushing this to drm-misc-fixes now, should still make it
to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the bug
is rather old. Also, worst case you leak 32bit of some kernel memory that
got reused already (but yeah I know that's often enough to get the foot in
somewhere nasty and crack the door open).
I think it fell through cracks because Sam said he'll apply, guess that
didn't happen.
Also yes a changelog, somewhere, for next time around.
-Daniel
>
> thanks,
>
> greg k-h
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Freedreno] [PATCH V2] drm: hold gem reference until object is no longer accessed
2020-07-27 20:11 ` daniel
@ 2020-07-27 21:54 ` cohens
-1 siblings, 0 replies; 10+ messages in thread
From: cohens @ 2020-07-27 21:54 UTC (permalink / raw)
To: daniel
Cc: adelva, freedreno, dri-devel, pdhaval, seanpaul, linux-arm-msm,
jsanka, sam
On 2020-07-27 16:11, daniel@ffwll.ch wrote:
> On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
>> On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
>> > A use-after-free in drm_gem_open_ioctl can happen if the
>> > GEM object handle is closed between the idr lookup and
>> > retrieving the size from said object since a local reference
>> > is not being held at that point. Hold the local reference
>> > while the object can still be accessed to fix this and
>> > plug the potential security hole.
>> >
>> > Signed-off-by: Steve Cohen <cohens@codeaurora.org>
>> > ---
>> > drivers/gpu/drm/drm_gem.c | 10 ++++------
>> > 1 file changed, 4 insertions(+), 6 deletions(-)
>> >
>> > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
>> > index 7bf628e..ee2058a 100644
>> > --- a/drivers/gpu/drm/drm_gem.c
>> > +++ b/drivers/gpu/drm/drm_gem.c
>> > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
>> > * @file_priv: drm file-private structure
>> > *
>> > * Open an object using the global name, returning a handle and the size.
>> > - *
>> > - * This handle (of course) holds a reference to the object, so the object
>> > - * will not go away until the handle is deleted.
>> > */
>> > int
>> > drm_gem_open_ioctl(struct drm_device *dev, void *data,
>> > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
>> >
>> > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
>> > ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
>> > - drm_gem_object_put_unlocked(obj);
>> > if (ret)
>> > - return ret;
>> > + goto err;
>> >
>> > args->handle = handle;
>> > args->size = obj->size;
>> >
>> > - return 0;
>> > +err:
>> > + drm_gem_object_put_unlocked(obj);
>> > + return ret;
>> > }
>> >
>> > /**
>>
>> As this seems to fix an important issue, any reason it wasn't cc:
>> stable
>> on it so that it gets backported properly?
>>
>> How about a "Fixes:" tag so that we know what commit id it fixes so we
>> know how far back to backport things?
>>
>> And a hint to the maintainers that "this is an issue that needs to get
>> into 5.8-final, it shouldn't wait around longer please" would have
>> also
>> been nice to see :)
>>
>> And what chagned from v1, aren't you supposed to list that somewhere
>> in
>> the changelog or below the --- line (never remember what DRM drivers
>> want here...)
>>
>> Care to send a v3?
>
> Don't worry, I'm pushing this to drm-misc-fixes now, should still make
> it
> to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the
> bug
> is rather old. Also, worst case you leak 32bit of some kernel memory
> that
> got reused already (but yeah I know that's often enough to get the foot
> in
> somewhere nasty and crack the door open).
>
> I think it fell through cracks because Sam said he'll apply, guess that
> didn't happen.
Sam added his Reviewed-By on V1 with a comment to rename the goto label,
but in V2 I also updated the API documentation and the commit text for
a more complete change and thought he would re-add the tag.
> Also yes a changelog, somewhere, for next time around.
Apologies, it won't happen again. Should I still submit a V3?
It looks like you've got Greg's concerns covered.
-Steve
> -Daniel
>
>
>>
>> thanks,
>>
>> greg k-h
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Freedreno] [PATCH V2] drm: hold gem reference until object is no longer accessed
@ 2020-07-27 21:54 ` cohens
0 siblings, 0 replies; 10+ messages in thread
From: cohens @ 2020-07-27 21:54 UTC (permalink / raw)
To: daniel
Cc: adelva, sam, linux-arm-msm, dri-devel, pdhaval, seanpaul, freedreno
On 2020-07-27 16:11, daniel@ffwll.ch wrote:
> On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
>> On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
>> > A use-after-free in drm_gem_open_ioctl can happen if the
>> > GEM object handle is closed between the idr lookup and
>> > retrieving the size from said object since a local reference
>> > is not being held at that point. Hold the local reference
>> > while the object can still be accessed to fix this and
>> > plug the potential security hole.
>> >
>> > Signed-off-by: Steve Cohen <cohens@codeaurora.org>
>> > ---
>> > drivers/gpu/drm/drm_gem.c | 10 ++++------
>> > 1 file changed, 4 insertions(+), 6 deletions(-)
>> >
>> > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
>> > index 7bf628e..ee2058a 100644
>> > --- a/drivers/gpu/drm/drm_gem.c
>> > +++ b/drivers/gpu/drm/drm_gem.c
>> > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
>> > * @file_priv: drm file-private structure
>> > *
>> > * Open an object using the global name, returning a handle and the size.
>> > - *
>> > - * This handle (of course) holds a reference to the object, so the object
>> > - * will not go away until the handle is deleted.
>> > */
>> > int
>> > drm_gem_open_ioctl(struct drm_device *dev, void *data,
>> > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
>> >
>> > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
>> > ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
>> > - drm_gem_object_put_unlocked(obj);
>> > if (ret)
>> > - return ret;
>> > + goto err;
>> >
>> > args->handle = handle;
>> > args->size = obj->size;
>> >
>> > - return 0;
>> > +err:
>> > + drm_gem_object_put_unlocked(obj);
>> > + return ret;
>> > }
>> >
>> > /**
>>
>> As this seems to fix an important issue, any reason it wasn't cc:
>> stable
>> on it so that it gets backported properly?
>>
>> How about a "Fixes:" tag so that we know what commit id it fixes so we
>> know how far back to backport things?
>>
>> And a hint to the maintainers that "this is an issue that needs to get
>> into 5.8-final, it shouldn't wait around longer please" would have
>> also
>> been nice to see :)
>>
>> And what chagned from v1, aren't you supposed to list that somewhere
>> in
>> the changelog or below the --- line (never remember what DRM drivers
>> want here...)
>>
>> Care to send a v3?
>
> Don't worry, I'm pushing this to drm-misc-fixes now, should still make
> it
> to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the
> bug
> is rather old. Also, worst case you leak 32bit of some kernel memory
> that
> got reused already (but yeah I know that's often enough to get the foot
> in
> somewhere nasty and crack the door open).
>
> I think it fell through cracks because Sam said he'll apply, guess that
> didn't happen.
Sam added his Reviewed-By on V1 with a comment to rename the goto label,
but in V2 I also updated the API documentation and the commit text for
a more complete change and thought he would re-add the tag.
> Also yes a changelog, somewhere, for next time around.
Apologies, it won't happen again. Should I still submit a V3?
It looks like you've got Greg's concerns covered.
-Steve
> -Daniel
>
>
>>
>> thanks,
>>
>> greg k-h
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Freedreno] [PATCH V2] drm: hold gem reference until object is no longer accessed
2020-07-27 21:54 ` cohens
@ 2020-07-28 8:52 ` daniel
-1 siblings, 0 replies; 10+ messages in thread
From: daniel @ 2020-07-28 8:52 UTC (permalink / raw)
Cc: daniel, adelva, freedreno, dri-devel, pdhaval, seanpaul,
linux-arm-msm, jsanka, sam
On Mon, Jul 27, 2020 at 05:54:59PM -0400, cohens@codeaurora.org wrote:
> On 2020-07-27 16:11, daniel@ffwll.ch wrote:
> > On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
> > > On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> > > > A use-after-free in drm_gem_open_ioctl can happen if the
> > > > GEM object handle is closed between the idr lookup and
> > > > retrieving the size from said object since a local reference
> > > > is not being held at that point. Hold the local reference
> > > > while the object can still be accessed to fix this and
> > > > plug the potential security hole.
> > > >
> > > > Signed-off-by: Steve Cohen <cohens@codeaurora.org>
> > > > ---
> > > > drivers/gpu/drm/drm_gem.c | 10 ++++------
> > > > 1 file changed, 4 insertions(+), 6 deletions(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> > > > index 7bf628e..ee2058a 100644
> > > > --- a/drivers/gpu/drm/drm_gem.c
> > > > +++ b/drivers/gpu/drm/drm_gem.c
> > > > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
> > > > * @file_priv: drm file-private structure
> > > > *
> > > > * Open an object using the global name, returning a handle and the size.
> > > > - *
> > > > - * This handle (of course) holds a reference to the object, so the object
> > > > - * will not go away until the handle is deleted.
> > > > */
> > > > int
> > > > drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > > > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > > >
> > > > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
> > > > ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> > > > - drm_gem_object_put_unlocked(obj);
> > > > if (ret)
> > > > - return ret;
> > > > + goto err;
> > > >
> > > > args->handle = handle;
> > > > args->size = obj->size;
> > > >
> > > > - return 0;
> > > > +err:
> > > > + drm_gem_object_put_unlocked(obj);
> > > > + return ret;
> > > > }
> > > >
> > > > /**
> > >
> > > As this seems to fix an important issue, any reason it wasn't cc:
> > > stable
> > > on it so that it gets backported properly?
> > >
> > > How about a "Fixes:" tag so that we know what commit id it fixes so we
> > > know how far back to backport things?
> > >
> > > And a hint to the maintainers that "this is an issue that needs to get
> > > into 5.8-final, it shouldn't wait around longer please" would have
> > > also
> > > been nice to see :)
> > >
> > > And what chagned from v1, aren't you supposed to list that somewhere
> > > in
> > > the changelog or below the --- line (never remember what DRM drivers
> > > want here...)
> > >
> > > Care to send a v3?
> >
> > Don't worry, I'm pushing this to drm-misc-fixes now, should still make
> > it
> > to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the
> > bug
> > is rather old. Also, worst case you leak 32bit of some kernel memory
> > that
> > got reused already (but yeah I know that's often enough to get the foot
> > in
> > somewhere nasty and crack the door open).
> >
> > I think it fell through cracks because Sam said he'll apply, guess that
> > didn't happen.
>
> Sam added his Reviewed-By on V1 with a comment to rename the goto label,
> but in V2 I also updated the API documentation and the commit text for
> a more complete change and thought he would re-add the tag.
>
> > Also yes a changelog, somewhere, for next time around.
>
> Apologies, it won't happen again. Should I still submit a V3?
> It looks like you've got Greg's concerns covered.
Uh no, but we need another patch to re-add the kerneldoc you deleted. I
missed that when merging your patch. Also that's kinda what patch
changelogs are for, for blind reviewers like me :-)
-Daniel
>
> -Steve
>
> > -Daniel
> >
> >
> > >
> > > thanks,
> > >
> > > greg k-h
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [Freedreno] [PATCH V2] drm: hold gem reference until object is no longer accessed
@ 2020-07-28 8:52 ` daniel
0 siblings, 0 replies; 10+ messages in thread
From: daniel @ 2020-07-28 8:52 UTC (permalink / raw)
Cc: adelva, sam, linux-arm-msm, dri-devel, pdhaval, seanpaul, freedreno
On Mon, Jul 27, 2020 at 05:54:59PM -0400, cohens@codeaurora.org wrote:
> On 2020-07-27 16:11, daniel@ffwll.ch wrote:
> > On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
> > > On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> > > > A use-after-free in drm_gem_open_ioctl can happen if the
> > > > GEM object handle is closed between the idr lookup and
> > > > retrieving the size from said object since a local reference
> > > > is not being held at that point. Hold the local reference
> > > > while the object can still be accessed to fix this and
> > > > plug the potential security hole.
> > > >
> > > > Signed-off-by: Steve Cohen <cohens@codeaurora.org>
> > > > ---
> > > > drivers/gpu/drm/drm_gem.c | 10 ++++------
> > > > 1 file changed, 4 insertions(+), 6 deletions(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> > > > index 7bf628e..ee2058a 100644
> > > > --- a/drivers/gpu/drm/drm_gem.c
> > > > +++ b/drivers/gpu/drm/drm_gem.c
> > > > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
> > > > * @file_priv: drm file-private structure
> > > > *
> > > > * Open an object using the global name, returning a handle and the size.
> > > > - *
> > > > - * This handle (of course) holds a reference to the object, so the object
> > > > - * will not go away until the handle is deleted.
> > > > */
> > > > int
> > > > drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > > > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > > >
> > > > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
> > > > ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> > > > - drm_gem_object_put_unlocked(obj);
> > > > if (ret)
> > > > - return ret;
> > > > + goto err;
> > > >
> > > > args->handle = handle;
> > > > args->size = obj->size;
> > > >
> > > > - return 0;
> > > > +err:
> > > > + drm_gem_object_put_unlocked(obj);
> > > > + return ret;
> > > > }
> > > >
> > > > /**
> > >
> > > As this seems to fix an important issue, any reason it wasn't cc:
> > > stable
> > > on it so that it gets backported properly?
> > >
> > > How about a "Fixes:" tag so that we know what commit id it fixes so we
> > > know how far back to backport things?
> > >
> > > And a hint to the maintainers that "this is an issue that needs to get
> > > into 5.8-final, it shouldn't wait around longer please" would have
> > > also
> > > been nice to see :)
> > >
> > > And what chagned from v1, aren't you supposed to list that somewhere
> > > in
> > > the changelog or below the --- line (never remember what DRM drivers
> > > want here...)
> > >
> > > Care to send a v3?
> >
> > Don't worry, I'm pushing this to drm-misc-fixes now, should still make
> > it
> > to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the
> > bug
> > is rather old. Also, worst case you leak 32bit of some kernel memory
> > that
> > got reused already (but yeah I know that's often enough to get the foot
> > in
> > somewhere nasty and crack the door open).
> >
> > I think it fell through cracks because Sam said he'll apply, guess that
> > didn't happen.
>
> Sam added his Reviewed-By on V1 with a comment to rename the goto label,
> but in V2 I also updated the API documentation and the commit text for
> a more complete change and thought he would re-add the tag.
>
> > Also yes a changelog, somewhere, for next time around.
>
> Apologies, it won't happen again. Should I still submit a V3?
> It looks like you've got Greg's concerns covered.
Uh no, but we need another patch to re-add the kerneldoc you deleted. I
missed that when merging your patch. Also that's kinda what patch
changelogs are for, for blind reviewers like me :-)
-Daniel
>
> -Steve
>
> > -Daniel
> >
> >
> > >
> > > thanks,
> > >
> > > greg k-h
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2020-07-28 8:52 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-20 22:30 [PATCH V2] drm: hold gem reference until object is no longer accessed Steve Cohen
2020-07-20 22:30 ` Steve Cohen
2020-07-27 19:55 ` Greg KH
2020-07-27 19:55 ` Greg KH
2020-07-27 20:11 ` daniel
2020-07-27 20:11 ` daniel
2020-07-27 21:54 ` [Freedreno] " cohens
2020-07-27 21:54 ` cohens
2020-07-28 8:52 ` daniel
2020-07-28 8:52 ` daniel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.